DDoS response plan

Hello.

I have a requirement to produce a DDoS response plan, and was wondering if anybody here had already done something similar and wouldn't mind sharing some tips or pointers on what they have included?  Such as how you monitor for DDoS attacks, how do you identify an attack, and what do you do to mitigate them?

We have a pair of SG230 appliances with TCP SYN Flood Protection, UDP Flood Protection and ICMP Flood Protection enabled.  What else can we do, or should we turn to our ISP for upstream detection and protection?

Thanks in advance for any tips!